Network Visibility and Packet Capture Specialist (SOC Tooling, Linux) for NATO with security clearance

A NATO cyber security operations centre in Mons can only detect what it can see. Theplatforms that give it that visibility - security monitoring traffic aggregation and full packetcapture across many networks sites and data centres - need one person who owns them properly. Thatis this role.

• Delivering and maintaining the network visibility and security monitoring capability theoperations centre works from.
• Acting as the subject matter expert for the operation configuration and lifecycle of securitymonitoring and packet capture technology.
• Managing that lifecycle end to end: deployment configuration maintenance upgradesobsolescence and decommissioning.
• Configuring and tuning monitoring traffic aggregation and packet capture so the datacollection is reliable and the analysis is worth doing.
• Watching platform health availability data quality retention storage use andperformance.
• Finding and closing the visibility gaps that would otherwise blunt threat detection.
• Troubleshooting Linux network connectivity performance and data collection problems acrossthe monitoring environment.
• Keeping the documentation real - architecture diagrams inventories operating proceduressupport information.
• Supporting the design of new monitoring solutions and their integration with the wideranalytics and incident management tooling.
• Working with the security analysts and the detection engineers so monitoring coverage keeps upwith what they need to detect.
• Capacity planning and scalability assessment and the compliance audit and assurance work thatcomes with cyber defence technology.
• Supporting cabling deployment planning and site surveys for monitoring and visibilityinfrastructure and taking part in cyber defence exercises when they run.

• Expert knowledge of network security monitoring and cyber defence operations inan enterprise monitoring environment.
• Extensive hands on experience supporting large scale distributed securitymonitoring across multiple networks sites segments or data centres.
• Enterprise-scale work with monitoring and traffic-capture tooling of the Firepower Corelight and NetWitness kind.
• Strong hands on work with network visibility traffic aggregation packet brokers and packetcapture.
• Proven platform health and performance monitoring capacity management troubleshooting andoperational governance.
• A deep grasp of how enterprise networks are built and how traffic actually moves through them.
• Linux and network troubleshooting: connectivity packet flow interfaces performance andsystem level diagnostics.
• Practical experience of cabling site surveys and the physical side of deploying monitoringinfrastructure.
• Confident with the signals security tooling produces: gathering them tying related events together spotting an attack and going looking for one.
• Fluent professional English.
• A relevant cyber security certification - CISM CISSP or GIAC Security.
• A bachelors degree in a related discipline with two years of relevant experience;exceptionally six years or more of progressive experience in the same work instead.

• Designing large scale security monitoring and network visibility architectures.
• Integrating monitoring tools with SIEM and SOAR platforms.
• Automation scripting or orchestration.
• Major platform upgrades migrations refreshes and service transition.
• Previous work in an international environment with both military and civilian elements and aworking knowledge of how NATO is organised.

• Fully on site in Mons Belgium in a normal office environment. Equipment isprovided for restricted information.
• 5 October to 30 Decemberhours in total.
• Occasional travel to other locations in support of operational duties reimbursed under NATOtravel rules. Travel inside the duty country counts as commuting.
• You must hold a valid clearance and be a citizen of a NATO member country.

If you have kept a sensor estate honest at scale - and you know the difference between adashboard that is green and a capture that is actually complete - this one is for you.